PRIVACY POLICY — LEARNIX
Courtesy translation. The binding version is the Portuguese (pt-BR) text. In case of any divergence, the Portuguese version prevails.
Version: 1.0 — draft for legal and operational review Date: October 14, 2026 Scope: website, web platform, Learnix mobile apps, corporate portals, teachers, artificial intelligence features and support. Reference controller: LEARNIX EDUCAÇÃO LTDA — CNPJ 52.628.506/0001-43 — Rua XV de Novembro, 964, Centro, Curitiba/PR, Brazil. Privacy contact: contato@learnixedu.com [confirm or create a dedicated privacy channel].
Implementation notice. This is a draft suited to the planned product. Items in brackets and technical operations not yet verified must be confirmed before publication. Controls, vendors or automated rights must not be claimed as operational before they are implemented.
1. Who we are and who this Policy applies to
Learnix provides language teaching services, live classes, proficiency assessments, educational materials, learning follow-up and artificial intelligence features through the website, the web platform and apps. This Policy explains how we process data of prospects, students, teachers, representatives of contracting companies and users of corporate environments.
Depending on the activity, Learnix may act as a data controller (when it decides the essential purposes and means of processing) or as a processor (when it performs operations on behalf of a contracting company following legitimate instructions). The specific role will be recorded per purpose and, where necessary, in a specific corporate contract. This Policy does not authorize indiscriminate sharing with the employer.
2. What data we process
Registration and identification. Name, email, phone, country, interface language, internal identifiers, credentials protected by the authentication provider, optional profile picture and communication preferences.
Contracting, tax and financial. Legal name or company name, CPF/CNPJ (Brazilian tax IDs), tax address and postal code where needed, contract holder data, plan, price, discounts, vouchers, signed documents, payments, due dates, invoices, billing data and transaction references. Full card data must be collected and kept by the payment provider, not by Learnix servers.
Learning and education. Language studied, level and assessment evidence, assessment answers, personal and professional goals voluntarily provided, exercise results, attendance, scheduled classes, feedback, materials, identified difficulties, milestones, certifications and pedagogical history.
AI and communication. Text messages, instructions and files sent to the AI, transcripts, audio recordings if enabled and authorized according to the flow, corrections, generated exercises and session metadata. When voice is used, the microphone is accessed according to the device permission; audio may be forwarded to speech-processing services. The extent of recording, storage and retention periods will be disclosed in the feature itself and in the privacy settings. We do not presume that voice is biometrics: we will not use voice-based biometric identification without specific information and an adequate legal basis.
Corporate portal. Company, department, employee relationship, program, subsidy, licenses, enrollment, participation indicators and progress reports within authorized limits.
Technical data. IP, access date and time, device, operating system, session identifiers, security logs, cookies, telemetry, failures and notification preferences. Advertising identifiers and optional SDKs depend on configuration and an appropriate legal basis.
Support and marketing. Messages sent to support, commercial interactions, contact source and preferences for promotional communications.
We ask students not to send unnecessary personal documents, medical data or other sensitive information in AI conversations, messages or materials. If a user shares sensitive information incidentally, its processing will be limited to the applicable legitimate purpose and to security controls.
3. Purposes and legal bases
| Purpose | Examples of data | Legal basis to assess/apply |
|---|---|---|
| Create and protect accounts | registration, logs, authentication | contract performance/preliminary procedures, legitimate interest as assessed, legal obligation |
| Provide classes, assessment, progress and support | enrollment, results, feedback, communications | contract performance; adequate legal grounds for additional data |
| Issue invoices and electronic service invoices (NFS-e) | CPF/CNPJ, address, transactions | legal/regulatory obligation and contract performance |
| Process AI for language practice | prompts, text, voice, files, learning evidence | contract performance for the contracted feature; consent where required for optional operations; specific assessment for sensitive data |
| Manage corporate benefits | relationship, licenses, necessary indicators | contract performance and/or other applicable bases, depending on each party's role |
| Security, audit and fraud prevention | logs, IP, events | legitimate interest with assessment, legal obligation and regular exercise of rights |
| Send optional marketing | contact, preferences | consent or another demonstrable legitimate basis; opt-out available |
| Publish testimonials/images | voice, photograph, name | specific, separate and revocable authorization as applicable |
The applicable legal basis will be defined per operation and documented internally. We do not make access to the service conditional on accepting marketing or advertising use of your image.
4. Adaptive learning and automated decisions
AI tools may suggest exercises, identify difficulty patterns and produce pedagogical recommendations from assessments, classes and practice. These recommendations are probabilistic and may contain errors. A teacher or authorized professional may review, confirm or correct relevant recommendations. AI results alone are not equivalent to formal CEFR certification and must not automatically determine decisions with significant effects on the student. The data subject may request information and review where applicable under the relevant rules.
Model training. Learnix does not claim a generic authorization to train third-party models with students' conversations. Before launch, it will verify each vendor's contracts and settings, retention practices and any use of data for training; these practices will be disclosed truthfully and kept up to date. Any additional use to train proprietary models must be assessed and communicated with the appropriate legal basis.
5. What the company and HR can see
When a student is linked to an organization, authorized HR users may view information needed to manage the program: enrollment, language, assessed level when permitted, attendance, milestones, progress and aggregated consumption of benefits. Access may be restricted by department and role.
HR does not get default access to full AI transcripts, private conversations, confidential teacher notes, personal tax data that is not relevant, or personal content sent to the tool. Aggregated indicators and rankings must apply thresholds to prevent re-identification in very small teams. Data of students who also hold a personal enrollment is not automatically shared with former employers.
6. Sharing with third parties
We may share only the necessary data with: hosting and database (e.g., Supabase, if contracted), authentication, AI/voice provider, existing assessment services, video calls, payment processing (e.g., Asaas, subject to approval), NFS-e issuance, electronic signature, email (e.g., Resend), push delivery (e.g., Apple/Google/Expo services), support and providers that assist operations. The vendors actually used, their data categories and policies must be kept in the Register of Processors and Sub-processors, published or made available where applicable.
We do not sell personal data. We do not provide contracting companies with personal data beyond what is necessary for legitimate purposes and corresponding permissions. We may disclose information when required by law, by a competent authority or for the regular exercise of rights.
7. International transfers
Infrastructure, AI, notification and communication services may process data in other countries. Before enabling them, Learnix will verify location, contractual instruments and a legitimate international transfer mechanism, with the applicable safeguards of the LGPD (Brazilian data protection law) and ANPD regulation. The final list of vendors will be updated after approval.
8. Security and access control
We design authentication controls, per-organization segregation, role-based permissions, Row Level Security, encrypted traffic, private document storage, logging of sensitive actions, environment segregation and tested backups. These measures will be tested before going to production and continuously improved. No environment is entirely free of risk. In case of a security incident, we will follow the assessment, response and notification procedures required by law.
9. Retention, end of relationship and deletion
We keep data only as long as necessary for the purpose, contract performance, legal obligations, fraud prevention, protection of rights or other legal grounds. An internal schedule must define periods by category: tax/accounting data, contracts, logs, conversations, audio, assessments, backups and marketing data. No numeric period for audio or transcripts will be announced without implementation and validation.
Ending a corporate relationship ends or changes licenses paid by the company, but does not automatically delete the personal learning profile. When requesting account deletion, the user will be told what will be deleted, anonymized or kept due to legal obligation, according to the purpose and applicable periods.
The app will offer a deletion request flow at Profile → Privacy → Delete account and the web will provide an accessible external page, [public deletion URL to be published], as required by app stores. Support may confirm identity to prevent fraudulent deletions.
10. Data subject rights
Under the LGPD, the data subject may request confirmation of processing, access, correction, information on sharing, portability where applicable, deletion or anonymization in the cases provided, revocation of consent, objection and review of decisions made solely by automated means where applicable. These rights can be exercised through the email in the header or through the privacy area when available. We will respond within the legally required deadlines and may request reasonable identity verification.
11. Cookies, analytics and notifications
Strictly necessary cookies may be used for authentication, security and preferences. Non-essential advertising/measurement cookies or SDKs must be described in a table by vendor and managed through an appropriate preference mechanism, where applicable. The platform must allow choices to be reviewed. Users can control push notifications in account and device preferences; essential contractual and tax messages may continue to be sent through legally appropriate channels.
12. Children and teenagers
The experience was initially designed for professionals and adult users. If Learnix decides to serve minors, it must define, before the offer, a specific flow for legal guardians, age-appropriate information, best-interest assessment, data governance and suitable AI controls. A minor's mere acceptance of this document does not replace these measures.
13. Updates to this Policy
Learnix may update this Policy due to regulatory, technical or product changes. The effective date and version will be shown on the website and app. Material changes will be communicated appropriately, and new consents will be requested when necessary.
14. Contact
LEARNIX EDUCAÇÃO LTDA — CNPJ 52.628.506/0001-43 Address: Rua XV de Novembro, 964, Centro, Curitiba/PR — [validate current address] Email: contato@learnixedu.com — [confirm privacy channel/data protection officer] Privacy and rights page: [URL to be published].